Audit of Information Technology (IT) Asset Management

On this page

• Background
• Objective and scope
• Audit finding themes
• Key takeaways

Background

IT asset management (ITAM) is defined as the continuous process of maintaining an updated inventory of IT assets. It involves a set of policies and processes to help organizations account for all assets throughout their lifecycle^{footnote 1}.

At the RCMP, ITAM is a shared responsibility between Corporate Management and Comptrollership, the Digital Program, Divisional IT Services, and Departmental Security.

ITAM plays a crucial role in the effectiveness of any organization by helping to reduce maintenance costs, use licenses more efficiently, increase asset utilization, and better manage cybersecurity risks.

Objective and scope

The objective of the audit was to assess whether the IT asset management control framework is adequate, and if appropriate controls are in place for IT asset management.

The audit focused primarily on the operation and maintenance, and disposal phases of the asset lifecycle.

The scope period was from April 1, 2022, to November 30, 2024. The audit examined desktops and laptops operating on the RCMP Office Support System (ROSS), mobile workstations (ruggedized laptops), Universal Serial Bus (USB) storage devices, and enterprise and divisional application software.

Audit finding themes

The audit findings can be grouped into four themes:

1. Governance
2. Inventory Management
3. Operations & Maintenance
4. Disposals

Key takeaways

1. Policies are sufficient and generally understood by stakeholders, but there are opportunities to improve [REDACTED]
2. [REDACTED] While the IT Service Management modernization project was originally intended to provide a national solution with integrated inventory and asset management capabilities, the project has faced delays and has been rescoped to exclude the inventory and asset management components. A national enterprise inventory management system would assist to improve lifecycle and financial management [REDACTED]
3. Mechanisms are in place to ensure deployed IT assets are maintained during their lifecycle but there is a [REDACTED]
4. There are opportunities to improve the organization’s disposal practices and records management [REDACTED]